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Abstract 

Application  of  a  temporal  logic  to  forensic  analysis,  especially  in  answering  eertain  investigative 
questions  relating  to  time-sensitive  information,  is  presented.  A  set  of  temporal  faets  is  taken  from 
the  London  bombing  ineident  that  took  plaee  on  July  7,  2005,  to  illustrate  the  approach.  The 
information  used  in  the  illustration  is  gathered  through  the  online  news  sites.  A  hypothetieal 
investigation  on  the  information  is  earried  out  to  identify  eertain  time  intervals  of  potential  interest 
to  crime  investigators.  A  software  tool  ealled  Temper  that  implements  temporal  logie  is  used. 

1  Introduction 

The  growing  need  for  a  formal  logic  of  time  for  modeling  and  analyzing  temporal  information  has 
led  to  the  emergenee  of  various  types  of  representations  and  reasoning  sehemes.  Point-Interval 
Logie  (PIL)  is  one  sueh  formalism.  It  has  been  implemented  in  the  form  of  a  software  tool  ealled 
Temper.  The  expressive  language  of  PIL,  eombined  with  a  powerful  verification,  inference,  and 
revision  mechanism,  make  Temper  a  useful  tool  for  forensies,  especially  for  analyzing  the  time- 
sensitive  information  involved.  It  can  be  used  to  make  sense  of,  or  identify,  contradictions  and 
inconsistencies  in  the  temporal  information  available  about  a  particular  incident.  The  verifieation 
meehanism  of  PIL  can  be  used  to  cheek  the  consisteney  of  the  available  temporal  information.  The 
inferenee  mechanism  can  be  used  to  query  the  relationships  between  various  temporal  events.  The 
efficient  revision  meehanism  of  PIL  enables  what-if  analysis.  Thus,  investigators  ean  test  their 
theories  about  how  some  particular  incident  might  have  unfolded  on  a  timeline  using  Temper.  In 
this  paper  we  demonstrate  how  Temper  can  be  used  for  eriminal  forensies  by  using  the  scenario  of 
the  London  bombing  ineident  of  July  7,  2005. 

Point-Interval  Logie  (PIL)  is  a  specialization  of  Pointisable  Algebra  (Ladkin  and  Maddux 
1988).  It  originated  from  an  earlier  work  on  temporal  knowledge  representation  and  reasoning  by 
Zaidi  (1999).  The  earlier  version  of  PIL  was  an  extension  of  Hamblin’s  time  primitives  (1972)  and 
Allen’s  Interval  logie  (1983).  This  extension  allowed  the  inelusion  of  points  (i.e.,  intervals  with  zero 
lengths)  in  Allen’s  ontology.  The  formalism  presented  an  axiomatic  system  for  the  logie.  A  Petri  net 
(Peterson,  1981;  Reisig,  1991)  model  was  shown  to  represent  this  axiomatie  system  by  transforming 
the  system’s  speeifieations  (i.e.  qualitative  temporal  relations  between  system  entities)  given  by 
statements  of  Point-Interval  Logic  into  Petri  net  struetures.  The  Petri  net  strueture,  with  some  of  its 
analytical  tools  was  subsequently  renamed  Point  Graph  (PG).  An  inference  engine  based  on  this 
Point  Graph  representation  infers  new  temporal  relations  among  system  intervals,  identifies 


temporal  ambiguities  and  errors  (if  present)  in  the  system’s  specifications,  and  finally  identifies  the 
intervals  of  interest  defined  by  the  user.  Zaidi  and  Levis  (2001)  further  extended  the  point- interval 
approach  by  adding  provisions  for  “dates/clock”  times  and  time  “distances”  for  points  and  intervals. 
This  extension  allowed  the  assignment  of  actual  lengths  to  intervals,  time  distances  between  points, 
and  time  stamps  to  points  representing  the  actual  time  of  occurrences,  whenever  such  information  is 
available.  A  temporal  model  may  change  during  and/or  after  the  system  specification  phase. 
Support  for  an  on-the-fly  revision  (add,  delete,  modify)  was  added  to  Point  Graph  formalism  in 
Rauf  and  Zaidi  (2002).  Zaidi  and  Wagenhals  (2006)  consolidated  the  results  of  the  previous  work 
on  the  logic  and  its  application  to  the  modeling  and  planning  time-sensitive  aspects  of  a  mission  and 
extended  the  approach  further.  The  extension  allows  for  a  larger  class  of  temporal  systems  to  be 
handled  by  incorporating  an  enhanced  input  lexicon,  allowing  increased  flexibility  in  temporal 
specifications,  providing  an  improved  verification  and  inference  mechanism,  and  adding  a  suite  of 
analysis  tools. 

The  paper  is  organized  as  follows:  In  Section  2,  we  present  a  brief  discussion  on  Point- 
Interval  Logic  (PIL).  In  Section  3,  we  briefly  describe  the  user  interface  of  Temper  (software 
implementation  of  PIL).  We  illustrate  modeling  situations  arising  in  forensics  in  Section  4  using  the 
London  bombing  incident  as  the  scenario.  In  Section  5,  we  comment  on  the  contribution  of  this 
paper. 

2  Point-Interval  Logic 

The  lexicon  of  the  Point  Interval  Logic  (PIL)  consists  of  the  following  primitive  symbols: 
Points:  A  point  X  is  represented  as  [pX,  pX]  or  simply  [pX]. 

Intervals:  An  interval  X  is  represented  as  [sX,  eX],  where  ‘sX’  and  ‘eX’  are  the  two  end  points  of 
the  interval,  denoting  the  ‘start’  and  ‘end’  of  the  interval,  such  that  sX  <  eX. 

Point  Relations:  These  are  the  relations  that  can  exist  between  two  points.  The  set  of  relations  Rp  is 
given  as: 

Rp  =  {<5  =5  or  Rp  =  {less  than,  equal,  less-than-or-equal} 

Interval  Relations:  These  are  the  atomic  relations  that  can  exist  between  two  intervals.  The  set  of 
relations  Ri  is  given  as: 

Ri  =  {<,  m,  o,  s,  d,  f,  =}  or 

Ri  =  {less  than,  meet,  overlap,  start,  during,  finish,  equal} 

Point- Interval  Relations:  These  are  the  atomic  relations  that  can  exist  between  a  point  and  an 
interval.  The  set  of  relations  Rpi  is  given  as: 

Rpi  =  {<,  s,  d,  f}  or  Rpi  =  {less  than,  start,  during,  finish} 

The  symbol  ‘?’  can  be  used  to  represent  an  unknown  relationship 

Functions:  The  following  two  functions  are  used  to  represent  quantitative  information  associated 
with  intervals. 

The  Interval  length  function  assigns  a  non-zero  positive  real  number  to  a  system  interval. 
Length  X  =  d,  where  X  =  [sX,  eX],  d 

A  recent  extension  to  PIL  enables  specification  of  lower  and  upper  bounds  on  an  interval 
length.  The  two  bounds  can  also  be  represented  with  the  help  of  the  at  least  and  at  most  temporal 
relations. 


Length  X  >  d,  where  X  =  [sX,  eX],  d  (d  is  a  lower  bound  on  length) 

Length  X  <  d,  where  X  =  [sX,  eX],  d  e  (d  is  an  upper  bound  on  length) 

The  stamp  function  assigns  a  non-negative  real  number  to  a  point.  Recent  extensions  to  PIL 
enable  specification  of  lower  and  upper  bounds  on  a  point  stamp. 

Stamp  p  =  t,  where  t  '-^{0} 

Stamp  p  <  t,  t  u{0} 

Stamp  p  >  t,  t  u{0} 

In  Table  2.1  we  show  the  syntactic  and  semantic  structure  of  PIL  expressions.  Note  that  each 
relationship  between  intervals  or  an  interval  and  a  point  can  be  constructed  with  the  help  of 
inequalities  between  their  start  and  end  points. 

Table  2.1  PIL  Expressions  and  Their  Semantics 


CASE  I— 

X  and  Y  both  intervals  with  non-zero  lengths: 

X  = 

[sx,  ex],  Y  = 

[sy,  ey]  with 

sx  <  ex  and  sy  <  ey 

SX 

X 

ex  sy  Y  ey 

1. 

X<  Y 

ex  <  sy 

h- 

-(  P — — 1 

1  ^  H  Y  H 

2. 

XmY 

ex  =  sy 

1  1  1 

X 

h 

3. 

Xo  Y 

sx  <  sy, 

sy  <  ex. 

ex  <  ey  I — 

H  Y 

— 1 

4. 

Xs  Y 

SX  =  sy, 

ex  <  ey 

I - ^ - 1 

X 

5. 

XdY 

sx  >  sy. 

ex  <  ey 

i 

Y 

— 1 

- 1 

6. 

XfY 

sx  >  sy. 

ey  =  ex 

I _ Y  I 

X 

7. 

X  =  Y 

SX  =  sy, 

ex  =  ey 

h- 

h- 

Y 

H 

CASE  II- 

-X  and  Y  both  points:  X  = 

[px]  and  Y  =  [py] 

1 

X  Y 

1. 

X<Y 

X 

A 

px  py 

•  • 

2. 

X  =  Y 

II 

[X; 

;Y] 

CASE  III- 

—  X  is  a  point  and  Y  is  an 

interval:  X  =  [px]  and 

Y  = 

[sy,  ey] 

X  Y 

1. 

X<Y 

px  <  sy 

•  I - 1 

X 

Y 

2. 

Xs  Y 

px  =  sy 

H 

H 

X  Y 

3. 

XdY 

sy  <  px  < 

ey 

I- - 1 

Y 

X 

4. 

XfY 

px  =  ey 

h 

5. 

Y<X 

ey  <  px 

Y  X 

I - ^  . 

A  graph  construct  called  Point  Graphs  (PG)  is  used  as  an  underlying  structure  to  represent 
statements  in  PIL.  In  a  PG,  a  node  represents  a  point  (or  a  composite  point)  and  an  edge  between 


two  points  represents  one  of  the  two  temporal  relations,  less  than  and  less-than-or-equal,  between 
the  two.  Two  or  more  points  pi,  pj,  ...,  pn  are  represented  as  a  composite  point  [pi;  pj;  pn],  or  a 
single  node  in  a  PG,  if  all  are  mapped  to  a  single  point  on  the  timeline.  The  statements  in  PIT  can  be 
converted  to  an  equivalent  PG  representation  with  the  help  of  the  corresponding  analytic 
inequalities  shown  in  Table  2.1.  In  addition,  the  quantitative  temporal  information,  modeled  using 
the  length  and  the  stamp  function,  is  represented  as  node  and  arc  inscriptions  on  the  PG.  All  the 
verification,  revision  and  inference  algorithms  work  by  manipulating  this  Point  Graph 
representation  of  the  set  of  PIT  statements.  We  show  in  Figure  2.1  how  a  set  of  PIT  statements  can 
be  converted  into  a  Point  Graph. 


Point  pi,  p2,  p3 

pl<p2 

p2<p3 

Stamp  pi  =  4500 
Length  [pi,  p2]  =  100 


Figure  2.1:  Point  graph  representation  of  a  set  of  PIL  statements 


In  this  paper  we  explore  an  application  of  PIL  and  its  associated  algorithms  to  criminal 
forensic  analysis.  A  detailed  description  of  Point-Interval  Logic  and  Point  Graphs  can  be  found  in 
Zaidi  (1999);  Zaidi  and  Levis  (2001);  and  Zaidi  and  Wagenhals  (2006). 

3  Temper:  The  Software  Tool 

A  software  tool  called  Temper  (Temporal  Programmer)  implements  the  inference 
mechanism  of  Point-Interval  Logic  along  with  its  verification  and  revision  mechanisms.  Temper 
provides  a  language  editor  to  input  PIL  statements  and  a  query  editor  to  run  various  queries  on  the 
constructed  Point  Graph.  It  has  a  graphical  interface  to  display  the  Point  Graph  and  also  a  text  I/O 
interface  to  display  information  and  results  of  the  analyses.  Figure  3.1  shows  the  user  interface  of 
Temper.  In  the  PGs  shown,  each  point  is  represented  as  a  node,  and  each  interval  is  represented  by 
two  nodes  connected  by  a  less  than  (<)  or  LT  arc.  Each  LT  arc  is  represented  by  a  solid  arc  and  the 
length,  if  available,  appears  adjacent  to  the  arc.  Each  less-than-or-equal  (<)  or  LE  edge  is 
represented  by  a  dotted  arc.  The  stamp  on  each  point  appears  inside  the  node  representing  the  point. 
A  special  type  of  node,  called  virtual  node,  is  used  to  represent  at  least,  at  most,  no  later  than,  or  no 
earlier  than  temporal  relations.  Figure  3.2  shows  how  the  various  elements  of  a  Point  Graph  are 
displayed  in  Temper. 

4  Illustrative  Example:  London  Bombing  Investigation 

On  July  7,  2005,  there  were  four  explosions  in  London  at  Travistock  Square,  Edgware  Road, 
Algate,  and  Russell  Square.  Three  of  these  explosions,  Edgware  Road,  Algate,  and  Russell  Square, 
took  place  in  trains  that  departed  from  King-Cross  station.  Images  from  close-circuit  cameras 
installed  at  London’s  various  railway  stations  were  an  important  source  of  information  for 


investigators.  There  were  hours  of  images  available  from  these  cameras  and  the  task  of  investigators 
was  to  analyze  these  images  to  identify  possible  suspects.  The  large  number  of  such  images, 
although  desirable,  can  make  an  investigation  that  requires  searching  through  them  in  a  timely 
manner  very  time  consuming. 


Temper 


File  5eLLii  lyi 


Help 


Figure  3.1.  Temper  User  Interface 


c  ^ 


sB  ) 


Figure  3.2.  Point  Graph  Visualization  in  Temper 


In  this  section,  we  will  demonstrate  how  Temper  can  be  used  to  restrict  the  size  of  a 
potential  interval  for  which  to  analyze  images  (by  making  sense  of  the  available  temporal 
information.)  and  thus  speeding  up  the  investigation.  Since  Temper  has  the  ability  to  handle  both 
qualitative  and  quantitative  constraints,  both  types  of  information  regarding  the  incident  and/or  the 
surrounding  events  can  be  input  to  it.  Temper  also  offers  the  additional  advantage  of  the 
verification  mechanism  that  can  be  invoked  to  check  the  consistency  of  the  available  temporal 
information.  This  can  be  very  useful  when  temporal  information  may  originate  from  multiple  (and 
possibly  unreliable)  sources.  In  this  example,  we  will  demonstrate  the  capabilities  of  Temper  by 
modeling  a  set  of  temporal  information  items  related  to  the  incident  and  by  trying  to  identify  the 
exact  time  or  the  shortest  possible  interval  during  which  one  of  the  ill-fated  trains  left  from  King- 
Cross  station  for  Edgware. 


The  journey  of  the  three  trains  from  King-Cross  station  can  be  represented  as  PIL  intervals. 
The  journey  of  these  trains  ended  in  explosions.  We  also  know  the  lower  bounds  on  the  travel  times 
of  these  trains  after  their  departures  from  King-Cross  station,  based  on  the  distances  of  the  sites  of 
the  explosions  from  King-Cross  station.  The  train  from  King-Cross  to  Edgware  must  have  traveled 
for  at  least  5  time  units.  Similarly  trains  to  Algate  and  Russell  Square  must  have  traveled  for  4  and  5 
time  units,  respectively.  The  time  units  are  defined  by  a  mapping  from  actual  clock  times  to  an 
equivalent  representation  on  a  real  number  line.  Table  4.1  shows  how  this  information  can  be 
represented  as  PIL  statements.  These  PIL  statements  are  input  to  Temper  using  its  language  editor. 
Figure  4.1  shows  the  corresponding  Point  Graph  in  Temper. 

Table  4.1:  PIL  Statements  for  London  Bombing  Scenario 


Temporal  Information 

PIL  Statements 

Train  traveling  from  King-Cross  to  Edgware 

interval  Train_KingX_Edgware 

Train  traveling  from  King-Cross  to  Algate 

interval  Train  KingX  Algate 

Train  traveling  from  King-Cross  to  Russell 
Square 

interval  Train  KingX  Russell  Sq 

Explosion  at  Edgware 

point  Explosion  Edgware 

Explosion  at  Algate 

point  Explosion  Algate 

Explosion  at  Russell  Square 

point  Explosion  Russell  Sq 

Explosion  at  Edgware  ended  the  journey  of 
train  from  King-Cross  to  Edgware 

Explosion  Edgware  /  Train  KingX  Edgware 

Explosion  at  Algate  ended  the  journey  of  train 
from  King-Cross  to  Algate 

Explosion  Algate /  Train  KingX  Algate 

Explosion  at  Edgware  ended  the  journey  of 
train  from  King-Cross  to  Russell  Square 

Explosion  Russell  Sq  /  Train  KingX  Russell  Sq 

Train  from  King-Cross  to  Edgware  traveled  at 
least  for  5  time  units 

Length  [Train_KingX_Edgware]  >  5 

Train  from  King-Cross  to  Algate  traveled  at 
least  for  4  time  units 

Length  [Train  KingX  Algate]  >  4 

Train  from  King-Cross  to  Russell  Square 
traveled  at  least  for  5  time  units 

Length  [Train  KingX  Russell  Sq]  >  5 

Once  the  temporal  information  has  been  input.  Temper  can  be  used  to  draw  inferences  about 
the  point  of  interest,  i.e.,  the  instant  when  one  of  the  trains  left  King-Cross  station  for  Edgware.  We 
run  a  query,  using  the  query  editor  of  Temper,  for  the  time  stamp  of  the  point 
“sTrain  KingX  Edgware”  which  represent  the  departure  of  the  train  from  King-Cross  station  to 
Edgware.  Figure  4.2  shows  the  query  in  Temper  and  Figure  4.3  shows  the  result  of  the  query. 


“Query 


Query  Stamp 

sT  rain.  ^ 

1  sT  rain_Kin^_Edgvvare 

eT  rain_Kin^_Edgware 
sT  rain_Kin^_Algate 
eT  rain  KindK  Alqate 
sT  rain_Kin^_Russell_Sq 
eT  rain_Kin^_Russell_Sq 
Explosion_Algate 
EKplosion  Edqware 


Query  Length 


Query  Relation 


Figure  4.2.  Running  a  Query  in  Temper 


stamp 


Figure  4.3.  Result  of  the  Query 


For  the  illustrated  case,  Temper  cannot  infer  anything  about  the  stamp  of  the  event  based  on 
the  information  provided  so  far  (Figure  4.3).  Suppose,  further  investigation  reveals  that  the 
explosion  near  Edgware  took  place  between  time  units  840  and  845  (the  explosion  is  considered  to 
be  an  instantaneous  event  so  the  range  840  to  845  does  not  represent  duration  but  the  uncertainty  in 
determining  the  actual  occurrence  time).  Similarly  the  explosions  near  Algate  and  Russell  Square 
occurred  between  845  and  850,  and  between  840  and  850  respectively.  These  times  are  not  actual 
clock  times,  rather  their  equivalent  representation  obtained  by  mapping  the  clock  times  on  a  real 
number  line.  Table  4.2  shows  how  this  information  can  be  represented  as  PIL  statements.  These  PIL 
statements  are  added  to  the  initial  temporal  model  to  get  the  Point  Graph  of  Figure  4.4. 

Once  again,  the  query  for  the  time  stamp  of  the  point  “sTrain_KingX_Edgware”  is  executed. 
As  can  be  seen  in  Figure  4.5,  Temper  was  able  to  determine  an  upper  bound  for  the  stamp  of  the 
event,  i.e.,  the  train  from  King-Cross  to  Edgware  must  have  left  no  later  than  847. 

Table  4.2:  Additional  PIL  Statements  for  London  Bombing  Scenario 


Temporal  Information 

PIL  Statements 

Explosion  at  Edgware  happened  no  earlier 
than  840 

Stamp  [Explosion_Edgware]  >  840 

Explosion  at  Edgware  happened  no  later 
than  852 

Stamp  [Explosion_  Edgware]  <  852 

Explosion  at  Algate  happened  no  earlier 
than  845 

Stamp  [Explosion_Algate]  >  845 

Explosion  at  Algate  happened  no  later  than 
850 

Stamp  [Explosion_Algate]  <850 

Explosion  at  Russell  Sq.  happened  no  earlier 
than  840 

Stamp  [Explosion_Russell_Sq]  >  840 

Explosion  at  Russell  Sq.  happened  no  later 
than  850 

Stamp  [Explosion_Russell_Sq]  <  850 

s  Tram_KmgX_Edgware 


Figure  4.4.  Revised  Point  Graph  for  London  Bombing  Scenario 


Figure  4.5.  Result  of  the  Query 


As  indicated  earlier,  the  verification  mechanism  of  Temper  can  detect  the  inconsistencies  in 
the  available  temporal  information.  The  ability  to  detect  inconsistency  can  be  very  useful,  when  the 


information  from  different  sources  is  combined  into  a  single  model  of  the  situation.  Suppose,  we 
input  to  Temper  the  information  that  the  train  from  King-Cross  to  Edgware  left  at  time  instant  848 
(represented  by  the  PIL  statement:  Stamp[sTrain_KingX_Edgware]  =  848).  Clearly,  this  statement 
is  in  conflict  with  the  previously  added  PIL  statements.  Temper  detects  this  inconsistency 
(manifested  in  the  form  of  inconsistent  paths  in  the  Point  Graph,  shown  with  an  extra  boundary 
around  each  node  in  the  path),  and  identifies  the  portion  of  the  Point  Graph  that  contains  the 
contradiction,  as  shown  in  Figure  4.6.  Note  the  two  inconsistent  paths  (from  node  with  stamp  840  to 
node  with  stamp  852):  one  path  with  length  exactly  equal  to  12  units  and  the  other  path  having  a 
length  of  at  least  13  units.  We  fix  this  inconsistency  by  deleting  the  statement  “Stamp 
[sTrain_KingX_Edgware]  =  848”. 


Figure  4.7.  Inconsistency  in  the  Point  Graph 


Suppose  that  the  investigators  have  also  identified  four  suspects  who  were  spotted  entering 
the  Luton  railway  station  at  time  instant  720.  The  investigators  believe  that  these  suspects  took  a 
train  from  Luton  to  King-Cross  station,  and  at  King-Cross  station  they  boarded  the  trains  in  which 
the  explosions  took  place.  The  next  train  from  Luton  to  King-Cross  departed  at  748  and  reached 
King-Cross  at  time  instant  842.  Obviously,  if  these  suspects  were  in  fact  the  bombers,  the  train  from 
Luton  should  have  reached  King-Cross  before  any  train  in  which  there  was  an  explosion  left  King- 
Cross  station.  This  information  can  be  represented  by  PIL  statements  as  given  in  Table  4.3  and  the 
resulting  PG  is  shown  in  Figure  4.8.  Note  that  Table  4.3  contains  both  qualitative  and  quantitative 
PIL  statements. 

The  query  for  the  time  stamp  of  the  point  “sTrain_KingX_Edgware”  is  executed  one  more 
time.  Figure  4.9  presents  the  result  of  the  query;  Temper  was  able  to  determine  both  an  upper  bound 
and  a  lower  bound  for  the  stamp  of  the  event,  i.e.,  the  train  must  have  left  King-Cross  station  after 
time  instant  842  and  no  later  than  847.  Note  that  the  lower  bound  is  strict.  Thus  by  applying  the 
Point-Interval  Logic  to  the  analysis  of  available  temporal  information,  we  have  identified  the 
bounds  of  the  interval  that  we  were  interested  in.  The  images  need  be  analyzed  for  this  interval 
only;  this  improves  the  timeliness  of  the  labor  intensive  image  analysis  process. 

Table  4.3:  Additional  PIL  Statements  for  London  Bombing  Scenario 


Temporal  Information 

PIL  Statements 

Train  traveling  from  Luton  to  King-Cross 
station 

interval  Train  Luton  KingX 

Suspected  spotted  entering  the  Luton 
station 

point  Suspects  Spotted  at  Luton 

Suspected  spotted  at  Luton  at  time  instant 
720 

Stamp  [Suspects_Spotted_at_Luton]  =  720 

Train  from  Luton  to  King-Cross  left  at 
748 

Stamp  [sTrain  Luton  KingX]  =  748 

Train  from  Luton  to  King-Cross  arrived 
at  842 

Stamp  [eTrain  Luton  KingX]  =  842 

Train  to  Edgware  left  after  the  train  from 
Luton 

eTrain  Luton  KingX  <  Train  KingX  Edgware 

Train  to  Algate  left  after  the  train  from 
Luton 

eTrain  Luton  KingX  <  Train  KingX  Algate 

Train  to  Russell  Sq.  left  after  the  train 
from  Luton 

eTrain  Luton  KingX  <  Train  KingX  Russell  Sq 

Su  sp  e  cts_Sp  otte  d_at_LTiton^ 
72.0 


Figure  4.8.  Revised  Point  Graph  for  London  Bombing  Scenario 


Figure  4.9.  Result  of  the  Query 


5  Conclusion 

This  paper  presented  an  illustration  of  how  the  Point-Interval  Logic  (PIL)  can  be  used  to 
create  temporal  models  of  situations  arising  in  forensics  and  help  investigators  answer  interesting 
questions.  The  approach  was  demonstrated  using  Temper,  which  is  a  software  implementation  PIL, 
and  the  London  bombing  incident  as  the  scenario.  We  showed  how  Temper  could  be  used  to  answer 
meaningful  questions  during  an  investigation,  in  this  case  identifying  a  small  interval  for  which  the 
images  from  close-circuit  cameras  should  be  analyzed.  The  reader  may  argue  that  the  problem  could 
have  been  solved  manually  as  well;  that  is  true  in  the  case  of  a  small  example  like  this  one  but  in 
general  situations  the  set  of  temporal  statement  may  be  too  large  for  a  human  to  handle.  This  calls 
for  a  computer-aided  approach  to  such  an  analysis.  In  addition.  Temper  can  combine  temporal 
information  from  multiple  sources,  detect  inconsistencies  and  identify  the  specific  source(s)  with 
inconsistent  information.  Temper  can,  therefore,  be  used  to  compare  witness  accounts  of  several 
individuals  on  the  same  incident  for  overlaps  and  inconsistencies — another  useful  application  for 
forensics. 
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